Chrome Web Store - <AUTHOR> https://chrome.google.com/webstore/

<comment><USER2> This is part of an interesting trend that's potentially going to be very lucrative for developers.

Apple store, Chrome web store, Android market, etc. are all solving the marketing and distribution problem for developers all over the world. Furthermore with rankings and reviews the good apps will rise to the top while the bad ones will be lost in obscurity. It's increasingly a game of creating compelling products and not compelling marketing to win.

We're not quite there yet, there's still lots of work to be done with rankings, etc. but the trend is quite clear. I wonder when Mozilla will announce their app store.

<comment><USER3> Stores do very litte for marketing (the popular apps are popular due to being good and having been excellently marketed both in and out of stores, put an app on store with no marketing and see how well it does).

Mobile appstore made sense since there wasn't an existing distribution or discovery infrastructure. For web apps the Internet has already solved distribution and discovery..

I see appstores as a plague and counter to the open and free Internet. A few companies are getting (for practical purposes) "monopolies". Altering the level playing field into one in which developers are beholden to appstores.

<comment><USER4> I'd have to mention an exception to the "stores do very litte for marketing". The parts of the Apple App Store that are edited / curated by employees do have a significant affect on sales and can be seen as app store marketing. Also, the commercials from Apple that show apps boost sales also.

</comment></comment></comment><comment><USER5> I think Google's doing themselves a disservice by trying to make the Chrome Web Store sound too much like the App Store. It sets up the wrong expectation.

There's already a user backlash visible in reviews. A lot of people are disappointed that a Gmail app is just a link to the Gmail website, for example.

Here's a quick vocabulary of Google's terms and what they actually mean:

app – website

store – directory

install an app – add a bookmark

paid app – paywall managed by Google

in-app purchase – paywall managed by third party

<comment><USER6> That's also my initial mindset as a developer, but I wonder how casual users will perceive this? Every time you open a new tab, the apps are there. It almost feels like an inventory in a game, like you "have" the app in some sense.

If nothing else, for a developer it must be hugely beneficial to get your website link to the new tab page.

</comment></comment><comment><USER7> I see that there is an HTML5 game for sale.

How viable is that? Wouldn't it be trivial to "steal" since you can just view the source code? Would obfuscation help at all?

I'd love to be able to sell HTML5 games, but it doesn't strike me as a realistic option.

<comment><USER8> This <http://code.google.com/chrome/webstore/docs/index.html#drm> and this [http://code.google.com/chrome/webstore/docs/check_for_paymen...](http://code.google.com/chrome/webstore/docs/check_for_payment.html) might be useful here...

<comment><USER9> Only to an extent. Once someone has access to the source, anyone could pirate or reverse engineer it, which seems to be the GP's concern.

However, this isn't necessarily any different than binary executables, which we know experience a fair amount of pirating.

Also from that FAQ:

"Update your app frequently, so that only authorized users will always have the latest, greatest version of the app. Distributing updates is easy, thanks to Chrome's support for autoupdate. You just increment the version number in the manifest, update the ZIP file, and then use the Chrome Developer Dashboard to upload and publish the updated ZIP file. Over the next few hours, the new version of the app starts going out to its existing users."

"Don't put any roadblocks in front of users. Your app should be easy to buy, and it should work everywhere users want it to work."

That is: "Don't rely on DRM to protect you. It won't work, and you'll piss your users off."

</comment></comment></comment><comment><USER10> Can someone please develop an awesome web-based IDE, so that we, developers, are not left out of the Chrome OS goodness? You can include seamless integration with github, or dropbox, for "cloud" storage. And of course, I'm assuming HTML5 will allow you to work offline.

Has anyone used Bespin and/or any existing web-based IDEs? Googling didn't return anything compelling.

<comment><USER11> Our HTML prototyping tool Quplo (<http://quplo.com>) is a web-based IDE for designers and developers. It doesn't have github, dropbox, or server-side coding (offline support is on the way). It's purely meant for developing prototypes. But it's a start. We'd love to see more products in this arena and we'll definitely be making sure we're in the Web Store ASAP.

</comment></comment><comment><USER12> Anybody figured out how to setup a paid app? I already have an extension in the gallery but I don't see anywhere to set a price for it.

Also, it appears that only US and UK developers can be a Google Checkout merchant, _except_ for the Android Market where anyone from one of a bazillion different countries can sell.

However, the Chrome Web Store developer ToS seems to imply that other payment processors can be used, provided they are approved by Google. It doesn't say who those payment processors are or how they integrate with the store.

So yeah, anybody figured out how it all works?

</comment><comment><USER13> It is possible to monetize the chrome applications using ads? I am looking in the terms of use, but I dont find anything against it.

<comment><USER14> Yes it is. Its like the web, once the user goes to your App you can show them whatever you want.

</comment></comment><comment><USER15> I wonder if this means the Android Market's official web front-end is almost ready to go.

They previewed it at Google IO and it still hasn't surfaced :-(.

</comment><comment><USER16> Get ready to play some PopIt. Actually, I've never heard of this game before. But now that it's shipping with chrome I can play it all the time at work.

</comment><comment><USER17> Are these web apps hosted on a google server or on the publishers?

<comment><USER3> These apps seem to be nothing more than links to websites.

Am I missing something?

<comment><USER18> Indeed. I expected some sort of trimmed down simpler versions that would load more easily on a Chrome OS netbook. So far I've tried MapQuest and Evernote, and both just showed up as the regular bloated websites that they are upon 'installation'.

</comment></comment></comment><comment><USER19> it will be interesting to see if this is a way for google to provide a marketplace within ios devices (specially) via a potential release of chrome for iphone/ipad/ipod, effectively allowing android developers an in to both consumer groups.</comment>


Techdirt's First Amendment Fight for Its Life - <AUTHOR> https://www.techdirt.com/articles/20170111/11440836465/techdirts-first-amendment-fight-life.shtml <comment><USER2> The issue is in the same category as patent trolls.

Basically, our society has ended up in a place that you can sue anyone you want out of business as long as your lawyer team is bigger and better than theirs, despite how ridiculous or wrong your claims are.

I think the solution hinges on very large punitive damages for offending parties who sue for no reason and lose, e.g. in this case suing a magazine over "I invented email and you can't say that I didn't, give me $15M" should result in the accuser having to pay $15M himself because the claim is obviously a lie, and the _intent_ of the lawsuit is not to be proven right but to _harm_ the defendant.

<comment><USER3> Does cost matter? Tentatively, there may be a compelling case for jail time for something like this. "Intent to cause harm" isn't necessarily physical harm. The concept of legal assault is one that could be useful.

Though it opens up a very slippery slope, and I would hope it would have damn high standards for proving malicious intent.

<comment><USER4> I don't think that idea holds up to scrutiny, because:

\-- As you point out, resorting to the legal system should at most be criminalized only in the most extreme instances of abuse.

\-- Those extreme instances aren't the hardest problem to solve, because the legal system already knows how to dispose of OBVIOUS nonsense.

\-- Any apparent counterexample to my assertions would probably already be covered by other criminal statutes, such as those pertaining to perjury.

</comment></comment></comment><comment><USER5> I really hope this gets more attention. Techdirt has been a pretty good publication and this lawsuit is absolutely ridiculous.

</comment><comment><USER6> Newegg's lawyer should help them</comment>


Performing Hyperparameter Optimization with Amazon Machine Learning - <AUTHOR> https://github.com/alexandraj777/machine-learning-samples/tree/master/hyperparameter-optimization <comment><AUTHOR> I was playing around with Amazon ML and built a quick hyperparameter optimization example based on Amazon's GitHub example for k-fold cross validation. I'm an engineer at SigOpt so there's a SigOpt example, but I've also included a non-SigOpt hyperparameter optimization pipeline that updates the old Amazon k-fold cross validation example to boto3, runs as a single file, and lets you provide a list of hyperparameters upfront.</comment>


DIY Coffee Table Pong Game - <AUTHOR> http://digital-diy.com/electronics-project/344-coffee-table-pong-game.html <comment><USER2> Once LCD monitors and TVs became popular and cheap, I expected to see a lot more "LCD underneath a glass coffee table" projects. Then again I haven't built one myself, either.

This project is interesting from the hack value of making your own display. If you're not doing it for the LED control experience, the price of cheap LCD monitors is so low its hard to justify. Most TVs have a perfectly good analog VGA input so drive it with a propeller microcontroller which has a perfectly good VGA library, or do yet another raspberry pi project.

<comment><USER3> Often, or even mostly, DIY or hacking projects are not economically worth it. Which is why, often, economics is the last reason for doing it, especially when you factor in time and an hourly rate. Usually its fun, educational, or novelty, perhaps uniqueness. This project ticks all 4 of those boxes. Even back in the 70's when I first started making radios, better, cheaper ones could be bought in shops. I made radios because I thought it was amazing to actually make my own.

Mostly, projects like this are simply about a challenge or simply making something different. As you point out, these days a monkey could interface a cheap off the shelf screen and controller. Where is the challenge there? Whats the point? If this guy (or gal) wanted a screen....

Knocking it because its possible to do another way misses the point, and fun.

<comment><USER2> Oh I get the point completely and am not knocking it.

"If you're not doing it for the LED control experience"

Every project of any significance involves selecting tradeoffs. For example I didn't bother researching but I assume these guys went IKEA for their major non-hack related carpentry rather than breaking out the table saw and doing the whole thing by hand.

Sometimes for financial reasons you "have to" take a certain selection; definitely not the case in this scenario WRT the display technology. Which is cool for people who want to try something similar, but different.

They didn't really build "a" thing, they made a unique set of their game board, and a homemade display, and custom controllers, etc.

So its a valid point that if you don't care about display tech you're better off economically with an undermount TV (although those are strangely unpopular.. why? Cooling?). However if you care about controlling LED arrays that would kind of invalidate the entire point of that individual hack.

"possible to do another way misses the point, and fun."

I'd disagree in that my comment shows a guy who can't / won't do the LED display thing, can have just as much fun doing something very similar instead using exotic fine woodworking hand carpentry, or more elaborate software, or more elaborate user interface(s). The "LED display" part of the concept is an interesting and cool, but optional, part of the overall project (unless as previously discussed the point of the hack was to use LED displays...)

If you want to invest 100 hours in "build a video game table" there exist some possible substitutions for the recipe that taste just as good. Or if you want to invest 100 hours in "build a big LED array display" there is more than one recipe for that (although I didn't bring it up... how bout some "game of life" software on that microcontroller? That would also look cool.)

(edited to add: we do agree on it being a cool synthesis of your four checkboxes; I'm just saying other recipes also exist)

<comment><USER4> I see your point. Different people find different parts of the DIY project interesting. And that they can use other, economically efficient, pre-made options for the other stuff. like a electronics hobbyist might enjoy the LED part, where as a crafter would probably enjoy the woodwork and just use a screen to play pre-made games instead.

And I agree with you on the screen idea, why dont we see more of that? Though i do kinda feel that we missed that window, now that we have tablets... isn't that the same thing? but with screens i suppose you get the size factor. I would love to look into this idea of a custom gaming table... imagine bomberman on a table!! That would be so cool!

</comment></comment></comment></comment><comment><USER4> hahahha nice! We actually made something that in sophomore year as a project. But that was on a much much much much smaller scale (5x5 matrix). We even fooled some people into believing the game had an AI player at the other end by giving the ball's input in that row :P so it mirrored the ball exactly! Was funny how the "Artificial Intelligence" was one wire connection!</comment>


WSGI Is Dead: Long Live WSGI Lite - <AUTHOR> http://dirtsimple.org/2011/07/wsgi-is-dead-long-live-wsgi-lite.html <comment><USER2> _But the WSGI Lite protocol is actually backwards compatible with WSGI. You can write code to the WSGI Lite API, and transparently interoperate with existing WSGI servers, apps, and middleware._

Correct me if I'm wrong, but doesn't this mean that it's WSGI _extra_ rather than WSGI _lite_? I mean, you don't generally consider the lite version of something to have the all the features of the full version and then some.

<comment><USER3> I think it just adds the boilerplate back in there for you :)

<comment><USER2> ...so then it's a framework?

<comment><USER4> Are you serious?

</comment></comment></comment></comment><comment><USER5> is it just me or is this completely flawed as a response to armin's article?

\- Armin: "you can't replace the 'bad' bits of WSGI for asynchronous apps without using some python extension like greenlet"

\- to which this article replies: "Armin is wrong, i've replaced WSGI! PS _: if you're an asynchronous server you have to use greenlet!"

_ see 'known limitations'

basically, in trying to challenge armin he's proved him right. and he does this without a hint of irony?!

<comment><USER4> No, that's not what he's saying... and I don't know if you realize this, but the author, P.J. Eby, is the same guy who wrote the original WSGI spec.

<comment><USER5> > I don't know if you realize this, but the author, P.J. Eby, is the same guy > who wrote the original WSGI spec.

yup (though to conclude anything from that fact is a clear fallacy).

I've realised that what I actually disliked most was his blog-post and not the actual project (I've used identical shims to wsgi-lite by choice over the years).

"CAN'T REPLACE WSGI WITH SOMETHING BETTER? CHALLENGE ACCEPTED"

"WSGI IS DEAD" (Except when it isn't.)

I realise that the above was probably done for facetious editorial reasons rather than his actual intention with the lib. He hasn't really replaced wsgi, he admits should only be used _wherever appropriate_

Armin uses the async point in part to give technical reasons why WSGI can't really be replaced in full, before concluding that he thinks replacing WSGI for purported notions of pluggable utopia is a red-herring anyway before posing the question of any WSGI replacement: does this really '[make] frameworks work better with each other?'

I don't think PJ really tackles any of that.

</comment></comment></comment><comment><USER6> This actually seems like a reasonable approach to me. WSGI isn't really friendly to application developers (because it's not the API they expect when they naively approach the problem) so mostly it's been wrapped by the various frameworks. Armin's article seemed to be saying "Stop bitching that you can't use WSGI because it's more complex than you think. Here's why. Just pick a framework."

This approach seems to take care of the 90% problem while leaving the full power of WSGI exposed if you want/need it. It's like a minimalist web framework to do just the smoothing over of the WSGI API and nothing else.

The backwards compatability is key: It can be adopted by application developers, and doesn't depend on server developers.

It may not have sprung into existence in a perfect form but I think it is definitely worth exploring this approach.

</comment><comment><USER7> Some related blog posts:

* _Let's talk about WSGI_ \- <http://www.b-list.org/weblog/2009/aug/10/wsgi/>

* _Snakes on the web_ \- <http://jacobian.org/writing/snakes-on-the-web/>

</comment><comment><USER8> Ok, I'm using WSGI every day but I haven't delved down into the details of it. But what would be the benefits of using WSGI Lite instead of the regular WSGI? Performance?

<comment><USER5> the _only_ benefit is not using start_response() before returning your data.

<comment><USER5> well, that's not quite all. _if you're writing middleware_ you sometimes have to write a some (mostly reusable) extra code to pass as the start_response() to other wsgi callables. (to access the headers and/or munge anything sent by .write() -- or disallow .write() entirely).

</comment></comment></comment><comment><USER9> I always thought of WSGI as a bridge between the web server and whatever web framework you happen to use, but this and the referenced article talk a lot about interaction between different frameworks and applications.

I don't really understand what is meant by this. Does this mean they want Django to interact with, say, Bottle?</comment>


'Yelp for People' App Founder Says Peeple Won't Be 'Shamed into Submission' - <AUTHOR> http://www.nytimes.com/2015/10/06/technology/yelp-for-people-app-founder-says-it-wont-be-shamed-into-submission.html <comment><USER2> "There is no 48 hour waiting period to remove negative comments. There is no way to even make negative comments."

No way to make negative comments? So what's the f-ing point of this app?

Kind of ironic that the founder complains about the backlash while her whole idea is an app to rate people.

</comment><comment> rm_-rf_slash I imagine the founder's experience should be seen as a prototype for the idea that people can be rated like a taco shack and not expect abuse to come out of it. It's already bad enough when falsehoods go viral and ruin reputations. Same things have happened with Campus Rumors, Yik Yak, and so on we've all been here before. Don't expect the worst of any audience to raise the bar on their own.

</comment><comment><USER3> Amusing how people freak out about app that lets you comment on other people with ability to not allow unfavourable comments, but no one bats an eye when presumtion of inosence is ignored by media and accusations are spread like butter (hell, some people (quite specific group) want to remove presumption of innosence from specific crimes I will not mention to not get shadowbanned today - and no one cares) Yes comment on some app is easier than accusation of crime in front of police or just sucessfull accusation on other media like twitter, but still - everyone will know that app is full of crap and grief so it is non damaging, its accusations elswere that shoulb be fought. Ah, hell with staying unshadowed - let the Stones Roll.</comment>


Ask HN: What 'hard tech' company are you founding or most interested in? - <AUTHOR> Where 'hard tech' is defined as requiring lots of time, money (or both) and may or may not be possible with high technical risk.<p>I'm just really interested in people working on fixing hard problems and want to know what is out there. <comment><USER2> Have you ever worked in a distributed system? If not, try one. If yes but you don't feel it hard, try improving its reliability/availability/scalability/performance/latency/debuggability/observability/consistency one order of magnitude (e.g. one more 9 in addition to 5 9s) at a time with one order of magnitude more distribution (e.g. spreading a global service to 10x more clusters/data centers).

<comment><USER3> if you have the money that is.

</comment></comment><comment><USER4> Founding: Genteract ([https://www.genteract.com](https://www.genteract.com)).

Goal: Real personalized medicine, including predicting which patients will respond to a drug, which won't respond well, and which will experience serious side-effects, based on their genetics.

We actually have a working system that can do this today: it's a new genetic analysis methodology that finds all the SNPs associated with a Gene- Environment interaction (GxE) through analysis of clinical data, and generates predictions for how other individuals will respond to the same environmental stimulus (food, drug, behavior, etc).

There's a long timeline and potentially large expenses involved in getting the right data to do drug predictions on (drug clinical trial data or EMR data), performing prospective clinical trials with the generated predictions, and finally getting FDA approval.

So we decided to start by analyzing existing NIH clinical study data (which we have access to by permission of the NIH and the respective study managers), focusing mainly on interactions between foods and nutrients (as Environment variables) and health parameters like BMI, sleep quality, cognitive measures, heart rate, etc. (as phenotype variables).

We're gearing up to launch a service that gives people access to these (and future) discoveries through analysis of their genetic data (either 23andMe or Ancestry genotype files, or whole genome sequencing that we'll offer).

</comment><comment> blaser-waffle Everything related to drone racing. Applications could be widespread -- but it's also just fun to watch/do.

Some research related to psilocybin, ibogaine, and MDMA happening, mostly in Canada. Several of those firms have gotten lots of small (<8MM USD) investments and look interesting. High risk, long-term plays.

<comment><USER5> Drone racing sounds amazing especially if it is autonomous racing.

How does one get started in this? I saw this [https://www.lockheedmartin.com/en-us/news/events/ai- innovati...](https://www.lockheedmartin.com/en-us/news/events/ai-innovation- challenge.html) but still don't know how I can start at small scale as a hobby.

</comment></comment><comment><USER6> Building learning systems that can operate on multiple modalities, and are totally interpretable. I think of these requirements as the basis for the next big jump in software usability, (I.e much better intelligent user interfaces)

AGI is not what I want to build, someone else can do that. For now I want to increase the capacity for people to build neural networks that researchers don't dream of doing, as easy as stitching together web APIs. I internalize this under the title "the Infrastructure of Intelligence"

Also, eventually I would like to work on a programming language for biology, and contribute to building wetware computers.

Another thing that I think the first project would help is longitudinal health tracking and quantifying human biology.

<comment><AUTHOR> Any resources to share that can serve as an introduction to this "Infrastructure of Intelligence" idea.

<comment><USER6> That term is something I sort of came up with, but certainly there are some cool papers.

[https://arxiv.org/abs/1905.10985](https://arxiv.org/abs/1905.10985) Is one, talking about using ideas like neural architecture search to build better learning systems. A lot of the references in it are golden.

I also wrote a set of notes formalizing what I see as the first step to building this infrastructure of intelligence. There's some great references in there: [https://osf.io/bv4qp/](https://osf.io/bv4qp/)

I'd be happy to talk about this and get your thoughts, you can hit me up on my email: harshsikka123 @ Gmail.com

I'm leading a research collaboration with some researchers in academia and industry, working on this actively!

<comment><AUTHOR> Thanks for the resources! I'll give them a deep dive over the next couple of days

</comment></comment></comment></comment><comment><USER7> Groundstation network management for LEO satellite connections. Nobody, including SpaceX has that figured out yet.

<comment><USER8> Oh? Interesting point. Although AWS applied for LEO licenses, and already has ground station solution. You think they do not have this near- or solved? [https://aws.amazon.com/ground-station/](https://aws.amazon.com/ground- station/)

</comment></comment><comment><USER9> Working on an idea to eliminate student debt/loans and increase teaching and non-teaching staff income.</comment>


Ask HN: Help me find a job for $400 per month - <AUTHOR> Dear HN,
I need about $400 to cover my monthly expenses of food, rent, internet etc. I can program in Python and Javascript, make descent looking websites using Bootstrap and deploy code to Linux boxes. Right now I only have money to cover this month's expenses only. I am ready to do any work as long as it covers my monthly expense - approximately $400. I am desperate.
I started learning web development this year and started working on an idea fulltime. I need to support myself till I can get my product out.
I will send more about me and my skillset upon request.
Thanks in advance. <comment><USER2> Look at Fiver, Odesk, and Elance.

My friend also offers virtual assistant jobs for $500/mo. I'll send along your info.

</comment><comment><USER3> Where are you located, and how can we contact you?

<comment><USER4> Seconded. Without this information there is literally no point in doing anything and the thread will die. OP, get a temporary email address if you're embarrassed and put out information up front. None of us are psychic and trying to get information by playing 20 questions is a _complete_ waste of people's time.

Not to be mean, but your failure to think this basic thing through probably correlates with your dire financial situation and does not reflect well on your coding abilities. That's probably a very unfair judgment because bad luck can strike anyone, but you only get one change to make a first impression. Fix it so I can delete this post.

<comment><AUTHOR> Thanks for your reply,

I have updated my contact information on profile.

</comment></comment></comment><comment><USER5> Why not just get a minimum wage job?

<comment><AUTHOR> I live in a place where no such jobs are available. I moved here hoping that I can work on my product and earn my living through small freelancing gigs. But the latter part is not working well.</comment></comment>


WikiLeaks: Cuba banned Sicko for depicting 'mythical' healthcare system - <AUTHOR> http://www.guardian.co.uk/world/2010/dec/17/wikileaks-cuba-banned-sicko

<comment><USER2> Sometimes I wonder if the sinister government backlash against WikiLeaks isn't part of an _even more devious and sinister plan_ to draw the news media's attention to the leaked information. That has certainly been its effect.

</comment><comment><USER3> Michael Moore has already posted pointing out the falsity in this 'leak'

[http://www.michaelmoore.com/words/mike-friends-blog/viva- wik...](http://www.michaelmoore.com/words/mike-friends-blog/viva-wikileaks)</comment>


How Shopify Scales Rails - <AUTHOR> http://www.confreaks.com/videos/2423-railsconf2013-how-shopify-scales-rails

<comment><USER2> Can hardly hear anything, really. Anyone has alternative audiotrack?</comment>


A design for time logging service needs your feedbacks - <AUTHOR> http://rocky-lake-5902.herokuapp.com/

<comment><USER2> I'm seeing dangling, single item columns in the graph.

Also, clicking on different dates the view still shows 'Jul 13'

It looks like, when it's polished I'd be able to see where I'm spending (or wasting) my time - which is awesome. Can it connect to other time tracking services?

<comment><AUTHOR> \- bug fixed \- I'm still thinking which service to connect. I'm using jawbone up to record work-out time, so it might be the first one to integrate. (If you have any good services, please advice)

</comment></comment><comment><AUTHOR> This site is inspired by Github time graph. I spent my weekend to build this prototype and would like to hear any feedbacks from HN. Thanks.</comment>


Why Did the Robot Do That? Increasing Trust in Autonomous Robots - <AUTHOR> https://insights.sei.cmu.edu/sei_blog/2016/12/why-did-the-robot-do-that.html <comment><USER2> _" I hope the lifter pilot doesn't get too bored." Jarvis is all chummy again._

 _" There is no pilot. It's a smart gel."_

 _" Really? You don't say." Jarvis frowns. "Those are scary things, those gels. You know one suffocated a bunch of people in London a while back?"_

 _Yes, Joel 's about to say, but Jarvis is back in spew mode. "No shit. It was running the subway system over there, perfect operational record, and then one day it just forgets to crank up the ventilators when it's supposed to. Train slides into station fifteen meters underground, everybody gets out, no air, boom."_

 _Joel 's heard this before. The punchline's got something to do with a broken clock, if he remembers it right._

 _" These things teach themselves from experience, right?," Jarvis continues. "So everyone just assumed it had learned to cue the ventilators on something obvious. Body heat, motion, CO2 levels, you know. Turns out instead it was watching a clock on the wall. Train arrival correlated with a predictable subset of patterns on the digital display, so it started the fans whenever it saw one of those patterns."_

 _" Yeah. That's right." Joel shakes his head. "And vandals had smashed the clock, or something."_

Peter Watts, Starfish

</comment><comment><USER3> It's not just how to make a robot explain itself, its decisions. Because even in plain good and old english there are level of understandings. Heck, even explaining some algorithms to someone IT-related isn't easy, when it comes from another field of knowledge.

When the AI(robot) decision is similar to a human daily thought, the difficulty is low. But even humans do things that they can't explain, and come with a later explanation that doesn't fulfill what just happened. When spurious correlations are found by AI, translating it to human understanding (not just language) will be very hard.

<comment><USER4> >But even humans do things that they can't explain

That is actually very interesting. I would even extend that sometimes, humans know the decision they are making is stupid/not the right one but the reward for taking that bad decision is worth it for him. Translating that flawed behavior into an AI must be terribly hard.

<comment><USER5> Moreover, often humans seemingly "can't explain" something - or invent nonsense explanations - because the act of actually explaining their reasoning could expose them to bad consequences, often social ones.

Question: why didn't you tell me you're going to a meetup after work?

Provided explanation: because I was so busy I forgot about it.

Real explanation: because I didn't want to have a conversation about it with you.

</comment></comment></comment><comment><USER6> "Analysis." \- Westworld

<comment><USER7> "Hmm"

 _Smirks, puts on tinfoil hat_

"Doesn't look like anything to me?"

<comment><USER8> And when it says "these violent delights have violent ends" you start running...

</comment></comment></comment><comment><USER9> This is really interesting research. I'm curious to see how it develops.

Building trust with users is going to be one of the most important product design challenges for all of these new "AI" fueled products. A self-driving car obviously requires a huge amount of trust from passengers. But even a personal assistant bot needs its users to trust it before they let it reach out to their contacts to schedule meetings or ask basic questions. There may well be overarching strategies that could be useful in either case, like the transparency into the machine's thinking described by the author.

</comment><comment><USER10> There is an area of research that addresses this specifically. How AI must be able to explain its decisions. If I find the paper again in my bookmarks I'll add an edit to it.

<comment><USER5> Related, the work Sussman is doing:

[http://dustybutt.org/blog/sussman-on-ai/](http://dustybutt.org/blog/sussman- on-ai/)

 _At some point Sussman expressed how he thought AI was on the wrong track. He explained that he thought most AI directions were not interesting to him, because they were about building up a solid AI foundation, then the AI system runs as a sort of black box. "I'm not interested in that. I want software that's accountable." Accountable? "Yes, I want something that can express its symbolic reasoning. I want to it to tell me why it did the thing it did, what it thought was going to happen, and then what happened instead." He then said something that took me a long time to process, and at first I mistook for being very science-fiction'y, along the lines of, "If an AI driven car drives off the side of the road, I want to know why it did that. I could take the software developer to court, but I would much rather take the AI to court."_

The article has links to the work he's doing in that area.

</comment></comment><comment><USER11> This is a really interesting and (I think) first of it's kind attempt at something like this.

One of the most important things for any relationship to work is trust, same for the human-robot relationship.</comment>


My war on SQL - <AUTHOR> https://financialcryptography.com/mt/archives/001207.html

<comment><USER2> Screw the _war on anything_ , it is not a war.

If you don't want to use SQL fine, don't.

And if you run a site called 'financialcryptography.com' on a secure server make sure your certificates are up-to-date.</comment>


Am I logged in or not? GDPR case study on the example of Chrome browser change - <AUTHOR> https://blog.lukaszolejnik.com/am-i-logged-in-or-not-gdpr-case-study-on-the-example-of-chrome-browser-change/ <comment><USER3> I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on.

I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilities due to how they're using their browser to give their services special functionality others can't get.

<comment><USER4> > I don't understand why the Chrome team is picking this hill to die on

Because they're not "dying on a hill" at all, because nobody cares. Nobody outside Hacker News and Twitter infosec people only followed by other Twitter infosec people cares about this.

> I really expect this change to push a lot of people away from chrome

Care to bet on that? Because I would happily take the opposite side of that bet. I think the feature will stay and after a few months we will see absolutely no change in Chrome's usage statistics.

<comment><USER5> > because nobody cares

A lot of people do not understand, but we do, we're the techies. It's our job to understand.

Don't mistake people not understanding for not caring.

Once people understand, they care.

<comment><USER6> Yeah, but my parents _understand_ Facebook collects/sells their data. But they don't _care_ enough to stop using Facebook.

<comment><USER7> They may understand it on a superficial level, but do they understand it on a practical one?

Everyone "understands" that Facebook collects user data. It's the contextual understanding that makes techies uneasy.

<comment><USER8> What you're saying is a pretty condescending way to treat other people's opinions. You're essentially questioning whether or not they _really_ understand (complete with scare quotes) if they don't share your opinion.

It's not the "contextual understanding" \- or any kind of understanding - <USER2> makes _some_ techies uneasy. It's their own opinions and personal comfortability with regard to data monetization. Many people understand their data is monetized in myriad ways and fully don't care. Asking if they actually understand is only going to patronize them.

<comment><USER7> I get where you're coming from, but it applies to me equally in plenty of other domains.

There are countless things I understand the basics of but am not an expert in. That's why we specialize, because we can't be experts in everything all the time.

I don't mean it to be condescending, I mean to express that I can know that stars are powered by nuclear reactions and yet not have a firm grasp of what that really entails.

Most people, including myself, have a shallow understanding of a _lot_ of things, and a deep understanding of very few things relatively speaking.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I can see why they thought this was a good change. It makes the UX for G-suite apps much more pleasant, almost like you get the full functionality of G-suite productivity stuff as part of installing Chrome. For most people, that's a good thing.

I think as tech people we systematically tend to under-think the second-order effects of the systems we build. Case in point, Chrome and G-suite being that closely integrated brings up serious privacy concerns, and the part where the Chrome team doesn't seem to appreciate the nuance reflects poorly. I do cybersecurity now (didn't used to), and a good number of problematic things I run into just come from engineers like my previous self not thinking through the security implications of a specific design, mostly because _not_ thinking about security means shinier UX delivered on less resources.

Just another example I encounter regularly: I use U2F to sign into my Google accounts. However, when you log in, the checkbox to "trust this computer" is checked by default, meaning that if you're not paying attention your account will get automatically downgraded to single factor authentication going forward. It's a clear nod to convenience, but done this way it makes you shoot yourself in the foot.

<comment><USER10> > your account will get automatically downgraded to single factor > authentication going forward.

*your device

If someone has access to my desktop PC, they also have access to my yubikey anyway.

<comment><USER11> Yubikey still saves you from a PC malware but I would suggest anyone not to store your yubikey besides your computer (or laptop bag) but to attach to your phone/keychain so it's on you all the time since it's safer that way.

<comment><USER10> If someone breaks into my apartment, I have more problems than losing my Yubikey. And my threat scope does not include agencies that would get my passwords AND be able to break in and steal my key. And if it did, I would think they could just take it from me.

</comment></comment></comment></comment><comment><USER12> Chrome has been the new IE for years. "just use chrome" is an endless refrain from webdevs who don't want to test on Firefox. Not sure why it is so hard for people to see what is going on here. Google has a massive conflict of interest with their web development efforts. This is classic Microsoft-esque Embrace, Extend, Extinguish.

<comment><USER13> That's a bad example. In technical progress, Chrome is the complete opposite of IE (which seems to be replaced by Safari these days) and way better than the rest in pushing forward new features. Also 99% of the time Firefox and Edge work just fine.

EDIT: Yes, IE was great in the beginning, but then it stagnated and earned the wide reputation of being terrible obsolete anchor that it is now known for. It's with this late-stage IE that I don't see the comparison since Chrome is still on the cutting edge.

<comment><USER14> I think you forget that in it's time IE was massively innovative.

It was IE who added XMLHttpRequest and invented AJAX.

<comment><USER15> They did it by ironic accident.

Bill Gates wanted their browser to be the best, but also wanted it not good enough to replace desktop apps. However the right hand didn't know what the left hand was doing. The Outlook team was told to make a web version. They got the IE team to add XMLHttpRequest for their use, everyone implemented what they needed to, then went home and forgot about it.

Then Google recognized what the feature allowed, and used it in gmail and maps. The rest of the internet said, "Wait, what, you can DO that?" Studied it, popularized the technique as AJAX and the rest is history.

<comment><USER16> This origin story of XMLHttpRequest being an afterthought explains why the class name has inconsistent capitalization which interestingly enough I never noticed until now.

<comment><USER15> You can find verification of it in the various references provided in [https://stackoverflow.com/questions/12067185/why-is-it- calle...](https://stackoverflow.com/questions/12067185/why-is-it-called- xmlhttprequest). In particular [https://web.archive.org/web/20170424220609/http://www.alexho...](https://web.archive.org/web/20170424220609/http://www.alexhopmann.com/xmlhttp.htm) is a snapshot of an explanation from the person who actually created the feature.

</comment></comment></comment></comment></comment></comment><comment><USER17> What I find troubling about this incident is not so much the change itself, or even how quietly they did it. It's the doubling down when users became critical. Rather than a "Okay wow, we clearly misunderstood the impact of this change and regret pushing the change without proper announcement or informed consent. We'll work to fix this." the messaging feels much more like "You're wrong to be upset. Trust us."

<comment><USER18> I think it's worth remembering that the userbase of chrome is huge and largely non-technical (i.e. they're not going to be on hn, twitter, reddit etc. voicing their opinion on the privacy implications of this change). What if for that big proportion of people the change is a net gain? Should it be reversed because the change is a net loss for a small subset of people?

</comment></comment><comment><USER13> [https://twitter.com/__apf__/status/1044109898013765632](https://twitter.com/__apf__/status/1044109898013765632)

 _> My teammates made this change to prevent surprises in a shared device scenario. In the past, people would sometimes sign out of the content area and think that meant they were no longer signed into Chrome, which could cause problems on a shared device_

I can see why there is pushback against this, but the issue described above is also understandable. There are valid reasons why "average" users would rather have this, and having unsynced or completely mismatched logins between Chrome and Google sites can lead to confusion for many who don't really see or care about a difference between them.

However it would be best if Chrome kept the settings to disable this. It doesn't make sense to remove those flags when they also have a large technical user base. Seems like good intentions but misjudging the impact of the decision and forcing it on everyone without recourse.

<comment><USER19> Except this doesn't actually "prevent surprises in a shared device scenario" for the web, in general; it does for Google sites and services only. Logging in to Facebook or Amazon or my personal blog does not show up as a browser indicator, nor does logging out of the browser also log one out of Facebook or Amazon or my personal blog.

This makes Chrome less of a _browser_ and more of gateway to Google services that happens to include a browser. Which will also trick non-technically-savvy people to accidentaly share their non-Google logins when sharing computers/"browsers".

<comment><USER13> Yes, but as I said, most people probably do consider it a single gateway to all of their Google services, browser included.

The big difference is that your Chrome account _is_ your Google account, unlike any of the other sites you mention.

<comment><USER20> People are perfectly capable of distinguishing between browsers and websites. For example, users have no problem logging into Facebook with Chrome.

Auto-signin only adds confusion. Many (most?) users have no reason to associate their browser with a Google account. This is something that Google is pushing unilaterally, just like Google+/YouTube integration. As an advertising company, they stand to benefit from more accurate user tracking.

<comment><USER13> Capable? Sure. But probably not interested in the difference.

Again, the _Chrome account is your Google account_ so you're not associating anything, you're just logging in. It's different than any other example where the website has a different account. Signing in to Chrome and then into Gmail is not what most users would expect because for them the browser really _is_ just another Google service.

There seems to a big (and sometimes willing) misunderstanding from HN/tech users about the mainstream population who just want things to work.

</comment></comment></comment></comment></comment><comment><USER21> I am baffled by _The particular Article 25 of GDPR is rarely seriously and meaningfully discussed in practice, not least because probably still almost nobody actually knows what the "data protection by design" even means_.

This seems to be a confusion straight out of a five-stages of grief denial of GDPR principles.

Let's work this through:

Step 1: Are you collecting personal data?

Step 2: If so, are you obtaining consent _prior_ to collecting this data?

Step 3: Are the instructions to the users transparent and understandable?

Step 4: Is your system designed to handle these?

Or is it hard, and since we haven't had to do it before, I would like to get out of this requirerment?

<comment><USER22> Hi, original author of the linked post here. Thanks for the input. However, consent is not related to the concept. In fact it's more about taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.

Additionally, the controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

Thanks.

</comment></comment><comment><USER23> As a Googler with no connection to the Chrome team: I'm pretty sure they made this change in good faith and are shocked people don't like it. Just imagine yourself in their shoes: wouldn't your first instinct be to explain yourself?

<comment><USER24> The Chrome team has been shocked about a lot lately.

I give them the benefit of the doubt on their intentions (although I'm less sure about upper management). But regardless of their intentions, they need to get better at thinking ahead.

Situations like this are always a little complicated, so I don't want to oversimplify or claim that they should have been psychic. But... it really shouldn't have been hard to tell that people would be upset. I kind of feel like if nobody on the Chrome team could have predicted this, then the Chrome team is seriously out of touch with users.

I mean, heck, the change contradicted Chrome's own privacy policy, which had to be updated after the fact. Is there seriously no process to check stuff like that before features ship? How is anyone supposed to trust Google's privacy policy when any team can break it inadvertently and it takes a Twitter thread weeks later for them to find out?

The Chrome team has a nasty habit of simultaneously saying, "just trust us, we're experts, we know what we're doing", and "there was no way we could have predicted that users would be upset by this."

Both of those things can't be true.

<comment><USER23> There is a process where external launches need to be approved by a separate privacy team. If you're certain you can do a better job, you can find some listings on [https://careers.google.com/](https://careers.google.com/) (just search for privacy).

<comment><USER3> I don't think that using this incident as a recruitment pitch is a good idea.

<comment><USER23> "Somebody should do a better job!" "Why don't you try yourself?" Seems like a somewhat reasonable train of thought. A lot of good things can come out of outrage, as long as people are willing to take action (no, I don't claim going through Google recruitment to be the optimal strategy, but it is an option)(I actually got my first job as a result of my technical complaints, obviously not in Google).

<comment><USER24> > "Somebody should do a better job!" "Why don't you try yourself?"

This argument makes sense when you're talking about a problem that one or two people control rather than a large system with higher stakeholders who may not have interests aligned with your own.

But I'll assume you're right for a sec. Let's assume that Google cares a ton about making sure their privacy policy is consistent, but it's just an insanely hard job and nobody could do any better.

Why does that matter? In that scenario, I still don't trust your privacy policy. I don't care whether it's inconsistent because people are incompetent or because the problem is hard. In either case, the privacy policy is unreliable. If I can't trust it in Chrome's case, how can I trust it in Gmail's case, or in Adword's case, or in any other product?

In a way, saying it's a hard problem is even worse. I would have felt better if you had come back and said, "oh, the Chrome team is just uniquely incompetent, but everybody else has got their stuff together."

<comment><USER23> My thinking is more in line of: if privacy team was bigger, it would intuitively have a way easier job keeping tabs on all the developments. However, that's a job without talent attractors like glamorous launches. When you're sailing smooth, nobody knows you exist. But when I mention they're hiring in an incident, I learn this is the wrong time to mention them.

But then again, I'm neither in privacy team, nor Chrome team, know no specifics of this case and can't really argue any position (note how I'm neither defending nor condemning the issue of OP). Just pointing out generalities that I don't see mentioned.

<comment><USER24> If Google's privacy team is understaffed or doesn't have enough resources to do its job, we should have a conversation publicly about that. I get where you're coming from, but Google isn't a company without resources. In this specific scenario, where there is an actual power dynamic at play, it's not enough to just say, "well, people should get involved." The people who get involved are not the people who are making long-term decisions about process.

If Google itself isn't acknowledging the problem, or worse, if Google is actively thwarting or working against its own privacy team, then anyone who gets involved will also end up starved for resources or moved to other teams. Google is not a level playing field for people who want to change the system from inside.

So it's not wrong at all for you to bring this up during an incident. But if we take the premise that this incident is the result of one of the largest companies in the world starving its own privacy team, not paying enough to attract talent, or not giving them enough input into internal processes... well, that's honestly something that needs to be discussed company wide. That's a very serious situation.

And if that's the case, users should be distrusting Google's privacy commitments until it has that conversation. The first step to fixing a problem is acknowledging the problem -- you won't get anywhere trying to fix a system that doesn't want to be fixed.

From the responses that have come out of Google regarding this incident, it doesn't sound much like it wants to be fixed. Changing that is the first step. Hiring people is the second.

By all means, let's talk about Google's privacy team. I am all for that. Let's get productive. But let's get actually productive. Let's have an open, public talk about management and resource allocation, and why the team is understaffed. From Google's AI/self-driving divisions, we know what it looks like when the company gets serious about attracting talent. And we know it has the resources to do so.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Are there any lawyers here who can tell us if this is actually a GDPR violation?

Most of the discussion here is about why people don't like the new Chrome feature -- but is it actually in violation of the GDPR?

<comment><USER26> As long as they don't really gather any data without an additional consent, I can't see how it could be. IANAL, of course.

But, if I was responsible for GDPR in Chrome I would be very worried that they are conflating "signed in" and "syncing" some places in the code, since this appearently used to be the same concept, per the old privacy policy.

</comment></comment><comment><USER27> So, it's bad because it _doesn 't_ sync your history by default? Even if the UI is confusing, the worst case here is thinking that your data is being synced when it's not. It's like the opposite of a privacy problem.

<comment><USER28> It's bad because it's by default signing you into a service you didn't ask to be signed into, and don't have an easy option of turning this off.

Sure, it doesn't automatically sync your browsing history _now_ , but we all know change happens gradually. It's just a "feature" to be enabled later.

I've never once signed into chrome in my life (on purpose). I don't want anything synced between browsers, I like to try and limit what gets kept in the cloud, and with this change they've simply just taken the option away from the user.

Yes, I'm sure that I'm in the minority, but I'm taking this opportunity to start switching to Firefox, switching my mail provider, and am hoping to send them a GDPR request to delete all of my data.

It's not necessarily just this issue that made me do it, it's just the tipping point for me that says.. "ok, this company has gotten too big off people's data, and i no longer wish to be a part of feeding that machine"

Just my 2 cents.

<comment><USER27> What is (or was) the difference between signing in to Gmail in the browser, vs signing in to the browser without sync?

(You might feel that this is a tipping point but it's still not a GDPR issue as far as I can tell.)

<comment><USER3> For one thing they have completely different privacy policies. By signing into the chrome they are automatically forcing people to accept the privacy policy that is far less private than the when people aren't signed in.

<comment><USER29> This doesn't seem to be turning on Chrome Sync, so users aren't being forced into any privacy policy:

[https://twitter.com/__apf__/status/1044109898013765632](https://twitter.com/__apf__/status/1044109898013765632)

<comment><USER3> Read the actual privacy policy, not the tweet talking about it. Primary sources are always best.

> The personal information that Chrome stores won't be sent to Google unless > you choose to store that data in your Google Account by signing in to > Chrome.

That doesn't say "unless you enable sync", it says it changes "by signing in to Chrome". Since they're now forcing you to sign into chrome without your consent they are also forcing you to accept that they can send your data to their services without needing any additional permissions from you.

<comment><USER30> Literally the next sentence after the one you quoted is:

> Signing in enables Chrome's synchronization feature.

This is no longer true, so it seems most likely that that entire paragraph is simply out of date.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> I'm still not clear about what the actual change in behavior even _is_ \- seeing some statements on Twitter from someone on the dev team, it sounded to me like there isn't actually any difference, just a UI change to show which Gmail account is currently logged into.

If that's really all it is, I don't really get what people are upset about. Specifically, if there's no additional data being stored connected to your account (which is what one of the devs seemed to be very explicitly claiming) until you deliberately connect Chrome to your account, this seems like a whole bunch of drama over a misunderstanding.

If I'm wrong, then that's a separate matter. Personally, I appreciate the syncing features, but I completely understand why people would be bothered, and it's definitely something they should roll back.

<comment><USER32> I work at Google, but all statements/opinions are my own.

My understanding is that there were two changes:

1\. General responsibility for authenticating to Google services has been moved to Chrome, and being logged into Google is equivalent to being logged into Chrome. If sync _is_ set up, logging back into Google also fixes your sync session, if it was broken (common — the warning in the toolbar is easy to ignore).

2\. Sync has been separated from login as a Chrome feature, so that you can log into Google services without syncing Chrome's data.

Confusion between being logged into Google (the Chrome new tab page looks a heck of a lot like the Google home page) and being logged into Chrome _was_ a real problem. I'm not suggesting that this is the _right_ solution… or the wrong one; this is weird territory.

It raises a question for both users and browser vendors: _What does it mean to be logged into a web browser?_

<comment><USER33> > It raises a question for both users and browser vendors: What does it mean > to be logged into a web browser?

And who - exactly - ever asked for the ability to "log into a web browser"? And what benefits are there for the user?

There would be zero confusion about "Am I logged in to Google or logged in to Chrome?" without the unwanted and unexpected existence of a "logged in to a web browser" status.

This is privacy disaster over a feature nobody wants. Except for the people who actively profit from privacy disasters...

<comment><USER31> I use several different computers and operating systems regularly, and it's _really_ useful to have my browser history, bookmarks, extensions and other configuration synced up.

That's not to say I'd be miserable without it, but it's a nice convenience that almost immediately upon starting up a new machine, my browser is set up exactly the way I like just logging in.

<comment><USER34> This illustrates what may be the real problem. Chrome's sync is a genuinely useful feature. There is no reason at all it needs to be conflated with being signed in to websites.

For that matter, sync is a fantastic use of E2E encryption, and it will be interesting to see if using sync data for any purpose other than syncing it is a GDPR violation.

</comment></comment></comment></comment></comment><comment><USER5> Well if the EU wanted to make an example, Google just handed it to them.

<comment><USER35> Hopefully that battle comes sooner than later. Either the EU will fold, or we would get some real guidance about what honoring this GDPR legislation actually means. Clearly nobody has any frigging idea what is and is not in compliance.

<comment><USER36> > Clearly nobody has any frigging idea what is and is not in compliance

The existence of a gray area doesn't mean that everything is gray area.

</comment></comment></comment><comment><USER37> I understand the general concern, but a bit confused about the details. Could someone do me a favor and write down a simple example of how this can violate privacy?

Something like "User logs into Chrome, this automatically logs the user into ???. The user then visits ???. As a result Google learns ??? about the user. This was impossible before this Chrome change, and this sharing of information isn't clearly agreed to by the user."

If there are several materially different scenarios that can result in privacy violation, would be great to know.

</comment><comment><USER38> It's just about respect. If you don't give your users a heads-up when you go to collect significant information about them, and then when they try to opt out, you cripple their browser, you do not respect them. I'm done with Google products.

<comment><USER39> I want to be done with Google products. But some of them are just so damn good. (Typed on my Pixel 2 XL)

<comment><USER40> Yeah, I hate cancer, but these ciggerettes are delicious!

<comment><USER41> Ha! That's a great analogy

</comment></comment></comment></comment><comment><USER42> It's a shame that this is where identity is going. Google had such a great opportunity to do this in an open way by making this a more extensible format...perhaps by dusting off OpenID. Identity is probably the most under- built part of the web, and anything Google could do to positively move that forward would've been hailed as a huge improvement.

Instead, because it's closed, it'll set the web identity conversation backward...hopefully it doesn't set it back too far.

</comment><comment><USER43> I think that currently pretty much every service, device and website violates the GDPR.

The GDPR requires consent or some other legitimate reason to store data about a person.

I see dark patterns everywhere. I never give consent. But I get tracked to death everywhere all the time. Even before I touch _anything_ on a website, it plants dozens of cookies on my machine.

But cookies are not even the problem. Fingerprinting is. When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads. Even though I don't store cookies on any of them.

Additionally, the web turned into an arcade game. The user has to rapid fire click away 'OK', 'I AGREE', 'I CONSENT', 'I UNDESTAND' buttons. He is not giving consent. He is just trying to get through this pile of nonsense to reach the content.

<comment><USER44> > He is not giving consent. He is just trying to get through this pile of > nonsense to reach the content.

Then don't access the content? Why should the user get content that someone has worked to create without having to give anything in return (whether that's in the form of payment or information). There would be no monetary incentive to create content anymore.

<comment><USER45> Guess what - the old Internet created plenty of content for free, without incentive of monetization, yet people still did it. The Web has suffered greatly as a result of the bullshit mindset that just because you put something online, you are entitled to make money for it.

<comment><USER44> Right, that's why I specifically said "monetary incentive". There will always be non-monetary reasons to create content.

Are you proposing that trying to make money using the internet is morally wrong? Or just that collecting user data is wrong? Or that collecting data without consent and a clear explanation is wrong? Because if the line is drawn at the latter, then that's what GDPR is for, and so I don't understand why people would be upset about having to click through a bunch of notices that try to make it clear how user data is being used.

<comment><USER46> The problem is that there's no actual consent, just simulacra. The GDPR doesn't say that you just have to "make it clear how user data is being used", it says the user must _freely give_ consent, which means they must not only explicitly do so, as not giving consent must _not_ mean the user loses access to services or content (see Recital 43).

</comment></comment></comment></comment></comment><comment><USER47> > _According to Google Chrome privacy policy "signed-in Chrome mode" works > differently than the basic (non-signed) mode. Accordingly "your personal > browsing data is saved on Google 's servers and synced with your account. > This type of information can include: Browsing history, Bookmarks, Tabs, > Passwords and Autofill information, Other browser settings, like installed > extensions"_

> _In line with privacy policy, this could be the case. However, data > synchronisation appears not to happen by default in practice (as also > confirmed here). It seems this behavior is not accounted by the privacy > policy, which means either the policy is obsolete (and needs to be updated, > which suggests potential issues in the internal privacy program, and > possibly the priorities), or the mechanic may be subject to change in > future._

It may have been updated in the last few hours, but right now, the privacy policy clearly specifies that that section is for the "Signed-in, Synced Chrome mode", and that "Sync is only enabled if you choose". Just signing in does not automatically enable sync.

</comment><comment><USER48> Imagine if Google open-sourced their sync server as Mozilla has [1]. If you could simply specify your own sync server, I suspect a lot of the louder privacy complaints related to sync would disappear.

(Obviously Google would never do this.)

[1] [https://github.com/mozilla- services/syncserver/](https://github.com/mozilla-services/syncserver/)

</comment><comment><USER49> I see many people here complaining about this feature, and while I completely agree with them I also find it difficult to imagine an effective way to clearly explain these concerns to a random average user with limited to no knowledge of computers. How would you go in explaining this stuff if you wanted to convince somebody to switch to another browser?

<comment><USER26> I would say that I hate this change. I have a university education in computer science, have worked with computers for many years, but don't understand what my browser is doing any more. The UI is unclear, the privacy policy says one thing, and the project manager says something else on Twitter.

It really frustrates me when applications try to guess what I want, and do things without asking. Computers are fun and interesting because they do what you tell them to do! When they do what someone think 90% of people want without asking you, they are oppressive and depressing.

Lastly, it feels like Google wants to trick me into giving them my browsing history by mistake.

So, all in all, I'll uninstall chrome from my personal computer.

</comment></comment><comment><USER50> Google search is great. The rest of stuff and all the tracking and personalisation crap is just ridiculous.

stuff like this are the primary reasons I:

1) use Chrome only for work - hey, it's new IE

2) don't use Android

and recommend against using these to all my friends and family, carefully explaining everytime that if they care about their data they should stay away from these services.

</comment><comment><USER51> IANAL, but I think the gdpr/antitrust case lies in the other direction,E.g not in [login on google/youtube]->[logged in in chrome] but in [logged in in chrome] ->[Can't use youtube/google anonymously].

If we take all of googles privacy controls and privacy policies for the truth, they now have an additional way to track me and I can't disable this without completely missing out on any other google service. This propably also circumvents any installed cookie blockers (but only for google) which could be interpreted as not honoring the denial of tracking.

</comment><comment><USER52> My workaround for now, which I hope continues to work past Chrome 69, is to use Incognito-Filter to force all google.com accesses to open in Incognito Mode.

[https://chrome.google.com/webstore/detail/incognito- filter/c...](https://chrome.google.com/webstore/detail/incognito- filter/cifilbmpnkjinlkchohdfcpdkmpngiik?hl=en)

This way I can log into Gmail and it won't log me into Chrome.

Obviously not ideal, and it doesn't excuse the deceptive and user-hostile malware Google just foisted on us, but it's a workaround.

</comment><comment><USER53> Please, Google, fix those mistakes soon, and avoid a PR fiasco.

<comment><USER54> Nobody really cares outside this tech bubble. There won't be a PR fiasco, because it's hard to explain why it's bad for a non techie end user.

"Google simplifies the login experience in Chrome", is essentially what's happening here and it's far from obvious how to sell it as a doomsday scenario as I read the mood correctly of many HN users.

<comment><USER55> Maybe I'm just crazy, but if I didn't like Google Chrome (or if I was a privacy hawk), I wouldn't use Google products. Why do so many people complain about "privacy" and still use Google products?

The people who think they can speak for their parents or the less technically inclined are being too presumptuous in my opinion. YOU may have a problem with these methods, but not everyone does. Heck, there's people as technical as you that still don't have a problem with it.

<comment><USER56> Super technical person who doesn't care, reporting in.

But I also wish we lived in a utopian society where all information, people, companies, govt. was public and there was no weird illusion of privacy that everyone is clamoring for.

I long accepted privacy on the internet doesn't exist, and mostly privacy off the internet is minimal, especially with all the technology around. If you want privacy, you need to live like the Amish.

So, I just accepted it, and now don't care about privacy breaches, giving all my data to google. I willingly give more data to google so they can make my life easier.

I get hopefully 100 years on this planet, I am not going to worry about privacy when I got better things to use my limited time and energy on.

</comment></comment></comment></comment><comment><USER57> I switched to Chrome in 2008. Today, I switched back to Firefox full time. Took about 30 mins to migrate everything and install extensions.

</comment><comment><USER58> Taking things into perspective, what benefit does I, as an individual user will get when Chrome automatically logs me in the browser when I sign into my Google account?

Unless there's a compelling benefit for me as a consumer, then I think Google wasted a lot of engineering hours and talent building something that majority of people would want no part of.

</comment><comment><USER59> This is the second time I've seen the reference to Chrome being the most secure browser. What's that based on?

<comment><USER60> Exploit prices and complexity usually accurately reflect the security of a product when compared to their competitors. Take a look at how much Zerodium pays for full-chain exploits here: [https://zerodium.com/program.html](https://zerodium.com/program.html)

      $250,000 - Chrome RCE + SBX (Windows) including a sandbox escape (previously: $150,000)

Whereas it's up to $100k for Edge RCE+SBX, $80k for Firefox RCE+SBX

You obviously need to factor in other things such as how popular the product is compared to competitors, etc., but such a drastic price difference such as this is quite telling.

<comment><USER61> You have a valid point but you are using misleading data: Don't compare a RCE + SBX vs a RCE w/o SBX. Firefox RCE + SBX is 80k, edge is 100k, safari is also 80k.

Another thing to take in consideration is the number of people that the exploit could be used against. For example, following this: [http://gs.statcounter.com/browser-market- share/desktop/world...](http://gs.statcounter.com/browser-market- share/desktop/worldwide), Chrome would have almost 68% of the browsing share whereas Firefox is only close to 10% and all the others even less. It'd be surprising this isn't taken account by Zerodium in their price calculations!

<comment><USER60> You're correct -- I was referring to the table that was easiest to quickly reference which is the _changelog_ , not _ALL_ current prices. The periodic table is more accurate. I'll update my post.

</comment></comment></comment></comment><comment><USER62> If I'm logged into gmail I'm logged into Chrome? Horror. I don't know what is a worse mistake: this or the idea to violate standards and ignore autocomplete=off, or deprecating sync XMLHttpRequest because "it's bad for UI and you don't need it".

</comment><comment><USER63> when my employer at the time asked for a research on ad blockers, I concluded we could 1 offer better content with a community focus, or 2 provide the browser with the best ad blocker, that could still show some of our ads.

we did the cost analysis of the later and decided it was too expensive at the time. a few months later google dropped firefox support and invested heavily on chrome.

I guess someone there did the same analysis. because everything to this point is right on the plan. they block auto play video ads, just not theirs. they block flash ads, just not theirs. they will implement tracking protection like firefox rolled out last month, but before they will keep you logged on their ad systems forever.

</comment><comment><USER64> This is an absurd and unfair hit-job.

Let me just spell out, for emphasis, what the article actually says:

* Logging in to a Google service via its website will now automatically show you as logged in to Chrome in the top-right corner. This will provide you with the OPTION to explicitly opt-in to syncing your browser data with the Google cloud by clicking a big blue button that clearly says "Sync as <firstname>" and then clicking through one of the two clearly-labelled options to confirm that you do indeed want to turn on sync in the following dialogue (which does in fact have a prominent "Undo" button in case you clicked by mistake).

* The entire extent of the alleged practical user privacy issue is that a user might accidentally click the first button, and THEN mistakenly click on the small "Want to manage sync and personalisation before they're turned on? Visit Settings." link instead of the larger, more prominent "Undo" button. This, the blog alleges, will turn on syncing without a chance for the user to undo. (Although, at least as of 69.0.3497.100, this is just plain false - there's an "Undo" button even on the settings page. It may have previously been true; I have not checked.)

* The entire extent of the alleged GDPR violation is that the privacy policy erroneously says that when you sign into Chrome with your Google Account, data is synced with Google's servers, when in reality it isn't unless you explicitly consent. (This was true at the time that the post was written, but the privacy policy was tweaked to correct the factual error - compare [https://web.archive.org/web/20180924020748/https://www.googl...](https://web.archive.org/web/20180924020748/https://www.google.com/chrome/privacy/) vs [https://web.archive.org/web/20180924123556/https://www.googl...](https://web.archive.org/web/20180924123556/https://www.google.com/chrome/privacy/.)) For what it's worth, I see no reason why briefly and accidentally claiming to process some data in a consent-ignoring way when you don't actually do so would be a GDPR violation, and the article does not elaborate on this particular legal theory.

Other commenters here have already explained that this change offers security/privacy benefits to some users by protecting them from a failure mode in which they wish to sign out of Chrome on a shared computer (in order to not sync their browsing history to a friend's or family member's account), but instead they only sign out of, say, Gmail, and thereafter end up inadvertently syncing their browsing history and passwords to their _friend 's_ Google account instead of their own. Connecting the browser login and Google web service login eliminates that privacy-violating failure mode. That seems like a real gain to user privacy and security to me, and it seems plainly absurd to argue that it's actually a loss on the basis of a hypothetical in which the user accidentally clicks through clearly-labelled buttons in two different dialogues and therefore accidentally enables syncing. That seems doubly true given that even in that hypothetical scenario, syncing can, per the article's own admission, then be immediately disabled (and all synced data deleted).

I'm not an uncritical fan of Google, but criticising them for this is bullshit.

</comment><comment><USER65> I'd be interested in hearing from vendors who are tied to Chrome. Authy springs to mind, only because their product is literally the only reason I still have Chrome installed anywhere.

</comment><comment><USER66> A possible workaround? Create a dummy account for Chrome login, and log in to your real account on Google websites?

That may still enable undesired cross-website tracking for Google Analytics or whatever?

</comment><comment><USER67> I'm waiting with bated breath for the first _massive_ GDPR case. Doesn't matter who, really. Just so long as the powers that be have fires lit under their asses.

</comment><comment><USER68> Anyway, is it relevant to not be logged in? You make it a bit harder for them, but it is easy to know who you are evn if you dont log in,

\- screen resolution,

\- browser add-ons installed,

\- ip localization

\- etc

It is called digital print i belive.

</comment><comment><USER69> does chrome let you choose what to sync? opera does (which is also forked from chromium), and you can encrypt the data with your own pw

<comment><USER70> Just in case you weren't aware; Opera is owned by a Chinese consortium. I personally wouldn't touch Opera with a ten foot pole.

<comment><USER69> your shirt was probably made by a chinese consortium too. why not touch opera because of that? americans.

<comment><USER70> Sorry to disappoint but I'm not American nor do I own any clothing from China (or any other countries that may rely on sweat shops for production).

From a security and privacy standpoint though there are possible implications when a tech-product/service is owned/controlled by a Chinese company. China's influence on it's businesses (especially tech related) can't be denied. It wouldn't surprise me one bit if news would break that the Chinese government has it's hands in Opera's cooking pot somehow.

Sorry if I have offended you but that's just reality. I don't trust Chinese tech companies.

<comment><USER69> i didnt mean to offend you either, it just seemed like more of a xenophobic than technical argument.

apple is lauded for the security and privacy of the iphone but it is manufactured in china. could china have their hands in that "cooking pot"?

if there were some kind of subterfuge occurring with opera at the hands of the chinese government, it would be newsworthy indeed.

<comment><USER70> I don't even know why I'm still arguing with you but there's a huge difference between something being assembled in China for a US company and a browser company with its jurisdiction in China. One can be compelled to aid the government the other not so much. You're comparing two entirely different things here. It's far easier to manipulate some lines of code than to modify the hardware of thousands of devices.

And I do take offense at being called xenophobic and won't further participate in this 'discussion'.

<comment><USER69> i was not calling "you" xenophobic, i was saying the sentiment of distrust for anything chinese seemed xenophobic to me, barring an explanation (which you provided, thanks. the exchange of ideas is good!). but i will call you a special snowflake

</comment></comment></comment></comment></comment></comment></comment><comment><USER71> I'm currently logged into Gmail. When I click the little upper-right icon in Chrome I see a button saying "Sign in to Chrome", implying I'm not currently signed in. "About Google Chrome" tells me I'm on version 69.0.3497.100 (on OSX). So I don't appear to be experiencing this issue. What am I missing?

<comment><USER29> You're missing nothing - this is the intended behavior. People are falsely reporting that you are automatically signed in to chrome sync, which isn't true.

</comment></comment><comment><USER72> Did Google Chrome just fire us as users?

</comment><comment><USER73> "apt-get install apache2" violates GDPR (logs IPs). It's not a difficult line to cross at all.

<comment><USER74> Lets try the law on this one:

Is the IP personal data for the GDPR? If I read the GDPR, the Debian foundation is not capable to pinpoint 1 person so it seems to me it is not (An ISP or someone receiving an IP to person mapping from them is something different):

      'personal data' means any information relating to an
      identified or identifiable natural person ('data subject');
      an identifiable natural person is one who can be
      identified, directly or indirectly, in particular by
      reference to an identifier such as a name, an
      identification number, location data, an online identifier
      or to one or more factors specific to the physical,
      physiological, genetic, mental, economic, cultural or
      social identity of that natural person;

Furthermore, the Debian foundation has a legitimate interest in monitoring their machines and protecting them against attacks. Logs containing IPs are a common practice, so there is a legal base for processing IPs even if they would be personal data:

      processing is necessary for the purposes of the legitimate
      interests pursued by the controller or by a third party,
      except where such interests are overridden by the
      interests or fundamental rights and freedoms of the data
      subject which require protection of personal data, in
      particular where the data subject is a child.

All of this assuming they use the IP for apache logs only, and don't send these logs to third parties for data mining or whatever.

<comment><USER75> Debian also has a privacy policy where they explain what kind of data they log and how long it is retained [https://www.debian.org/legal/privacy](https://www.debian.org/legal/privacy)

However, I can't recall ever having seen this privacy policy before now. IANAL and don't know what kind of notice needs to be given for necessary data usage, if any, but maybe apt-get should display the privacy policy on first use.

<comment><USER73> I meant you're violating GDPR by letting that apache2 server run with its default config, not that the apt maintainers are violating it.

<comment><USER74> And I meant you're not violating GDPR by letting apache2 run with default config, as the GDPR allows you to capture these IP adresses for 2 different reasons.

</comment></comment></comment></comment></comment><comment><USER76> [http://info.iapp.org/dz0uBmdUa20MA00Z5o100E0](http://info.iapp.org/dz0uBmdUa20MA00Z5o100E0) redirects to:

[https://blog.lukaszolejnik.com/am-i-logged-in-or-not-gdpr- ca...](https://blog.lukaszolejnik.com/am-i-logged-in-or-not-gdpr-case-study- on-the-example-of-chrome-browser-change/)

Please update the submission URL.

<comment><USER77> Ok, done. Thanks.

</comment></comment><comment><USER78> Real URL in case you don't allow JavaScript for the redirect: [https://blog.lukaszolejnik.com/am-i-logged-in-or-not-gdpr- ca...](https://blog.lukaszolejnik.com/am-i-logged-in-or-not-gdpr-case-study- on-the-example-of-chrome-browser-change)

</comment><comment><USER79> I'm assuming here that the changes are GDPR compliant (given the large army of lawyers working for Google).

If they are, all this brouhaha is from the technophile echo chamber of opinions. The average joe gives a rat's ass for this, as evident from all the non-noise coming out of the regular world. Techonopiles have made an art of outrage - typing on their $3000 laptop or $1300 iPhones built by slave-grinded employees toiling 16 hour days in China - NO HN COMMENTING ALLOWED AT WORK FOR THEM, BTW

Please go use FF & pretend to have privacy online or be better humans. Mozilla - the world leader in disappearing money [1]. Does it really take $225M to build & maintain the quantum browser? And why $135M for 'marketing'?

Mozilla 2016 revenues: $520M

Mozila 2016 R&D: $225M

Mozilla marketing: $135M

Remaining $160M - ???

[1] [https://assets.mozilla.net/annualreport/2016/2016_Mozilla_Au...](https://assets.mozilla.net/annualreport/2016/2016_Mozilla_Audited_Financial_Statement.pdf)

</comment><comment><USER80> Paging Max Schrems.

</comment><comment><USER81> Google is going back to China but this time they are requiring user's to sign in to their browser to be identified to search -- to tie their phone number to their account

Yet, the same exact thing just happened world wide in Chrome 69.

</comment><comment><USER82> I see a lot of comments on HN and other sites which could be summarized as whatabout-ism or defending the changes on the premise that "I know someone|people that will welcome this change."

The problem is that I can't help shaking the feeling that those comments are either written by people who do not consider privacy to be a right, or fail to understand GDPR, or are Google paid shills / fanatics.

Ultimately the changes represent dark patterns and I fear the worst is yet to come for the darling browser of the web. Someone somewhere at Google made the decision to turn Google Chrome in to AOL v2.

I take solace in the fact that AOL's walled garden approach ultimately failed.

</comment><comment><USER29> This doesn't enable sync.

See thread: [https://twitter.com/__apf__/status/1044109217903198210](https://twitter.com/__apf__/status/1044109217903198210)</comment>


Ask HN: Review my startup, Geopieces.com - <AUTHOR>

This startup is a location based service that lets you: Post your Content on the World map (geotagged) Own a Part of the World map (Virtual Property)
A mobile version and App is currently in development
www.geopieces.com
I am looking for genuine feedback and ideas.
We are currently working on simplifying the map you so can browse the content and navigate on the map at the same time.
Thank you very much in advance for any Feedback <comment><USER2> clickable: <http://www.geopieces.com></comment>


Disney takes full control of Hulu in deal with Comcast - <AUTHOR> https://www.engadget.com/2019/05/14/disney-comcast-hulu-ownership-deal/ <comment><USER2> Biggest takeaway from me in the article is NBC gets $500MM/year for its content catalog...WOW

</comment><comment><USER3> Hulu will become a "feature" of Disney+.</comment>


Hack 'n' Slash: Game about hacking and reverse engineering [video] - <AUTHOR> http://www.hacknslashthegame.com/

<comment><USER2> There's a play through with more details here: [https://www.youtube.com/watch?v=iv3K3ikSdsM](https://www.youtube.com/watch?v=iv3K3ikSdsM)

</comment><comment><USER3> The book mechanic may be one of the most impressively over built syntax highlighters I've ever seen. Very cool.

</comment><comment><USER4> This will make a great HN post when the game is out. (A trailer video is sort of borderline.)</comment>


FBI Releases Portraits Drawn by Serial Killer Samuel Little of His Victims - <AUTHOR> https://www.usatoday.com/picture-gallery/news/politics/2019/02/13/fbi-drawings-serial-killer-samuel-little/2855199002/ <comment><AUTHOR> The USA Today article doesn't seem to say it explicitly, but they (the FBI) are hoping people will help ID these women.

I first saw this here:

[https://percolately.com/ben/a-serial-killer-drew-haunting- po...](https://percolately.com/ben/a-serial-killer-drew-haunting-portraits-of- his-victims-from-memory-and-the-fbi-is-hoping-people-can-help-identify-them/)

It's not the usual HN thing, but it makes it clear why the FBI released the portraits.

</comment><comment><USER2> Does the site not work for anybody else from the EU on mobile? It says:

> _It appears that you're visiting us from a location in the European Union._

> _We are directing you to our EU Experience._

And then it just stays on the page with that message. I guess it's an experience alright.</comment>


Ads For Twits On Twitter (TwittAd Launches) - <AUTHOR> http://www.techcrunch.com/2008/09/02/ads-for-twits-on-twitter-twittad-launches/ <comment><USER2> This is not a great headline. At first glance I read this as "Ads for Tweets on Twitter".

"If you like this Tweet, tune in at 8pm Eastern for the next exciting episode!"

And then we're only one tiny step away from the diabolical Recursive Tweet -- the one that threatens to consume all Twitter resources in a massive self- referential singularity.</comment>


Tiller: Dynamic configs generated from (Consul|Vault|Zookeeper|HTTP|etc) - <AUTHOR> https://github.com/markround/tiller <comment><AUTHOR> Not my project, but I use it. It has helped me containerize older apps that are config file dependent. Helps bridge the gap without requiring a full refactor of the legacy application.</comment>


Free Your Technical Aesthetic from the 1970s - <AUTHOR> http://prog21.dadgum.com/74.html

<comment><USER2> hy</comment>